fix(objectstore): pass ExternalId when assuming the S3 export role

[AtMrun]

Problem

S3Sync assumes the target role via AssumeRoleRequest with only roleArn + roleSessionName. A role whose trust policy sets an sts:ExternalId condition rejects any assume that omits it — the caller-side effect is a generic AccessDenied on the S3 upload/download step that is indistinguishable from a missing trust-policy grant, which cost real triage time on CSA-526.

This is the same code shape as CONNECT-173 (atlan-generic-miner-app, fixed in #10) — BBVA POV hit it twice, once in each codebase's independent sts.assume_role implementation, because neither used a shared "assume role for S3" helper.

Change

• S3Credential.externalId: reads extra.aws_external_id, empty string if absent (mirrors the existing roleArn field).
• S3Sync takes an optional externalId constructor param; sets AssumeRoleRequest.externalId(...) only when non-blank, so roles without an sts:ExternalId trust condition are unaffected (an empty ExternalId would trip AWS's min-length-2 validation).
• Threaded s3.externalId through all four S3Sync(...) call sites in Utils.kt.

Not covered by this PR

• UI field to enter the External ID. None of the credential-form configmaps that back S3/Asset-Export role auth (csa-connectors-objectstore.yaml, csa-connectors-s3.yaml, packages/csa/s3/configmaps/default.yaml in marketplace-packages) expose an aws_external_id field today — same gap the generic-miner fix closed via its own configmap. Determining which of these three configmaps backs csa-asset-export-basic specifically (and safely regenerating its rendered JSON) is a marketplace-packages-repo change outside this PR's scope; flagging for a human to pick up as a fast-follow so CSA-526's customer path can actually be unblocked end-to-end.
• No new unit tests: S3Sync/S3Credential have no existing test harness (no mocks for the static AWS SDK v2 builders) to extend — adding one is a larger lift than this scoped parity fix; a human should decide whether to invest in that harness now or accept a manual-test callout on review.

Testing

• Manual review only — this sandbox has no JDK 17 (gradle :package-toolkit:runtime:compileKotlin fails on toolchain auto-provisioning), so I could not compile/run this locally. The diff is a small, mechanical mirror of the already-merged and tested Python fix; please run the module's build/tests in CI before merge.

Ref: CSA-526 ([bbva-pov] Asset Export — AssumeRole 403 missing ExternalId), CONNECT-173

🤖 Generated with Claude Code

[linear]

CSA-526

[AtMrun]

@sdk-resolve please review this PR, handle any review nuances/fixes, and get CI green. This mirrors the already-merged Python fix in atlanhq/atlan-generic-miner-app#10 (CONNECT-173) for the same missing-ExternalId gap. Flagged in the PR description: the marketplace-packages UI-field gap (no aws_external_id form field on the S3/Asset-Export credential configmaps) is NOT covered here and needs separate follow-up.